Cybercriminals Weaponize GitHub to Distribute Malware at Unprecedented Scale

Threat actors are increasingly exploiting GitHub's trusted infrastructure to stage large-scale malware distribution campaigns, according to a January 2026 analysis by security researcher Brian Tant. Microsoft's investigation into the Storm-0409 malvertising campaign found that attackers infected close to one million devices worldwide using GitHub-hosted malicious code. A separate campaign dubbed GitVenom saw hundreds of fake repositories created over several years, deploying backdoors, remote access tools, and clipboard hijackers that stole approximately five Bitcoin worth around $440,000. Security researchers also identified over 1,300 GitHub repositories vulnerable to RepoJacking, a technique allowing attackers to hijack existing trusted projects and inject malicious code. These campaigns exploit developers' inherent trust in GitHub-hosted content, using professionally crafted README files, realistic commit histories, and GitHub's own release infrastructure to distribute malware such as Lumma Stealer, SectopRAT, and Vidar.